The juniper_hyper crate versions before 0.10.1 have a vulnerability where the graphql() and graphql_sync() functions read the entire POST request body into memory without size limits. This can lead to unbounded memory consumption and potential denial of service by exhausting server memory. Version 0.10.1 introduces a default 2 MiB limit on request body size, responding with 413 Payload Too Large for larger bodies, and allows customization of this limit via juniper_hyper::BodyLimit.